feat: implement full bff logic

config/packages/cache.yaml

@@ -0,0 +1,16 @@
+framework:
+    cache:
+        app: cache.adapter.filesystem
+
+        pools:
+            # Backs App\Session\BffSessionStore. Filesystem is fine for a
+            # single instance under low/moderate traffic — safe across
+            # concurrent PHP-FPM workers, no extra service to run.
+            #
+            # If you ever scale to multiple BFF instances/containers,
+            # switch adapter to cache.adapter.redis and add:
+            #   provider: '%env(REDIS_DSN)%'
+            # No code changes needed elsewhere.
+            bff.session_cache:
+                adapter: cache.adapter.filesystem
+                default_lifetime: 3600

config/packages/framework.yaml

@@ -0,0 +1,19 @@
+framework:
+    secret: '%env(APP_SECRET)%'
+    http_method_override: false
+    handle_all_throwables: true
+
+    # Used only for the short-lived PKCE/state leg in AuthController
+    # (/auth/login -> /auth/callback). App sessions are the separate
+    # Redis-backed, sid-keyed store in App\Session\BffSessionStore.
+    session:
+        cookie_secure: true
+        cookie_httponly: true
+        cookie_samesite: 'lax'
+
+    http_client: ~
+
+    # Filesystem cache is sufficient here — used only to cache Keycloak's
+    # JWKS in IdTokenDecoder, not for session state.
+    cache:
+        app: cache.adapter.filesystem

config/packages/monolog.yaml

@@ -0,0 +1,58 @@
+monolog:
+    channels:
+        - deprecation # Deprecations are logged in the dedicated "deprecation" channel when it exists
+
+when@dev:
+    monolog:
+        handlers:
+            main:
+                type: stream
+                path: "%kernel.logs_dir%/%kernel.environment%.log"
+                level: debug
+                channels: ["!event"]
+            console:
+                type: console
+                process_psr_3_messages: false
+                channels: ["!event", "!doctrine", "!console"]
+
+when@test:
+    monolog:
+        handlers:
+            main:
+                type: fingers_crossed
+                action_level: error
+                handler: nested
+                excluded_http_codes: [404, 405]
+                channels: ["!event"]
+            nested:
+                type: stream
+                path: "%kernel.logs_dir%/%kernel.environment%.log"
+                level: debug
+
+when@prod:
+    monolog:
+        handlers:
+            main:
+                type: fingers_crossed
+                action_level: error
+                handler: nested
+                excluded_http_codes: [404, 405]
+                channels: ["!deprecation"]
+                buffer_size: 50 # How many messages should be saved? Prevent memory leaks
+            nested:
+                # Plain rsync/Deployer shared hosting (see deploy.php), not a
+                # container — nothing collects stderr here, so log to the
+                # shared var/log dir that already survives releases.
+                type: rotating_file
+                path: "%kernel.logs_dir%/%kernel.environment%.log"
+                max_files: 14
+                level: debug
+            console:
+                type: console
+                process_psr_3_messages: false
+                channels: ["!event", "!doctrine"]
+            deprecation:
+                type: rotating_file
+                channels: [deprecation]
+                path: "%kernel.logs_dir%/%kernel.environment%.deprecation.log"
+                max_files: 14

config/packages/prod/framework.yaml

@@ -0,0 +1,3 @@
+framework:
+    router:
+        strict_requirements: null

config/packages/routing.yaml

@@ -0,0 +1,12 @@
+framework:
+    router:
+        utf8: true
+
+        # Configure how to generate URLs in non-HTTP contexts, such as CLI commands.
+        # See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
+        #default_uri: http://localhost
+
+when@prod:
+    framework:
+        router:
+            strict_requirements: null